Dashboards & Visualizations

Different users see different version of same dashboard in Splunk

ashish9433
Communicator

I have a Splunk App created. Which has in App access permission. There are various dashboards in the App, and Dashboards have different panels.

Whenever i open the same dashboards i see different sets of panels and when the person who has created opens he see's different set of panels for the same dashboard.

i.e for the same dashboard, different users see different version. Can any one help me what exactly would be the issue.

I suspect it is permission related issue, but how same dashboard is shown differently. If it would have been permission related then the user who do not have access should not be able to see the dashboard itself rather than showing different versions.

0 Karma
1 Solution

rjthibod
Champion

First, are you running Splunk in a Search-Head cluster, or is this a standalone search head?

If you are running in a search-head cluster, you probably want to make sure your knowledge bundles are properly syncing between members. You will need to dig into DMC/MC for this.

Otherwise, it is likely due to local changes that are user-specific and hidden in a user's local folder, not the app's local folder. If you have access to the search head, look in $SPLUNK_HOME/etc/users/<USERNAME>/<APP_NAME>/... to see if there is a copy of the dashboard XML file inside the tree under that folder. If there are different versions of the dashboard XML in the users' folders, then that very well could explain it. If this is the case, then you would need to decide what is the most authoritative copy everyone should see. If the desirable copy is the one originally packaged in the app, then you need to do some work to remove the local copies. Otherwise, it is best to move the most authoritative local copy to the local folder in the app, $SPLUNK_HOME/etc/apps/<APP_NAME>/local/data/ui/views/

View solution in original post

rjthibod
Champion

First, are you running Splunk in a Search-Head cluster, or is this a standalone search head?

If you are running in a search-head cluster, you probably want to make sure your knowledge bundles are properly syncing between members. You will need to dig into DMC/MC for this.

Otherwise, it is likely due to local changes that are user-specific and hidden in a user's local folder, not the app's local folder. If you have access to the search head, look in $SPLUNK_HOME/etc/users/<USERNAME>/<APP_NAME>/... to see if there is a copy of the dashboard XML file inside the tree under that folder. If there are different versions of the dashboard XML in the users' folders, then that very well could explain it. If this is the case, then you would need to decide what is the most authoritative copy everyone should see. If the desirable copy is the one originally packaged in the app, then you need to do some work to remove the local copies. Otherwise, it is best to move the most authoritative local copy to the local folder in the app, $SPLUNK_HOME/etc/apps/<APP_NAME>/local/data/ui/views/

ashish9433
Communicator

Perfect, the files were found in the local folder of the user rather than the app folder and hence the issue.

Thanks for answering.

But can you highlight why did this happened? Where exactly is the issue that is causing the dashboards created by user to be stored in his local folder rather than app's folder?

0 Karma

rjthibod
Champion

It has to do with permissions. When you look at the permissions in Splunk, it will say if something is shared in all of splunk, just in the app, or just for the user. Depending on how user creates/edits a dashboard will determine the default permissions.

0 Karma

ashish9433
Communicator

thanks for the prompt, revert @rjthibod

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...